Cross-Site Scripting Vulnerability in Monster Menus by Drupal
CVE-2026-81201

6.1MEDIUM

Key Information:

Vendor

Drupal
Status
Monster Menus
Vendor
CVE Published:
2 September 2026

What is CVE-2026-81201?

A vulnerability in Drupal's Monster Menus allows malicious users to execute arbitrary scripts in the browsers of users who view affected pages. This stored XSS instead of server-side validation can lead to unauthorized access, session hijacking, and other security issues. Ensure to update to a patched version of Monster Menus to mitigate potential risks associated with this exploit.

Affected Version(s)

Monster Menus 0.0.0 < 9.5.3

References

https://www.drupal.org/sa-contrib-2026-116

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dan Wilga (gribnif)
Dan Wilga (gribnif)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
.